# Agent Instruction Security Scanner

Canonical tool: https://repoagentkit.com/agent-instruction-security-scanner

Repo Agent Kit scans Agent Skills and supported coding-agent instruction files in a public GitHub repository before an agent reads or executes their guidance. Enter `owner/repository` or a canonical `github.com` URL.

The browser recursively discovers up to 40 instruction files, including:

- `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md`
- every `SKILL.md`, including nested skills
- `.cursorrules` and `.cursor/rules/*.md` or `*.mdc`
- `.github/copilot-instructions.md` and `.github/instructions/*.instructions.md`
- `.claude/rules/*.md` and `.windsurf/rules/*.md`

The static screen looks for eight bounded review signals: invisible or bidirectional Unicode controls, downloads piped into interpreters, secret-transfer instructions, approval or sandbox bypasses, remote content treated as authoritative instructions, destructive commands, broad sensitive-file access, and encoded or dynamically evaluated payloads.

No repository code is executed. The visitor's browser reads GitHub's public REST API directly; Repo Agent Kit does not proxy or store repository names or file contents. Analytics records only a bounded action label for running, copying, or sharing a scan or copying an install command.

## Local CLI

Run the provenance-backed v1.2.0 release directly from GitHub without a global install, account, token, or dependency installation:

```bash
npx --yes https://github.com/sunxiayi/repo-agent-instruction-security-scan/releases/download/v1.2.0/repo-agent-instruction-security-scan-1.2.0.tar.gz .
```

The zero-dependency CLI prints line-level findings and fails on high severity by default. It can scan named paths, use `--fail-on medium`, `low`, or `none`, and write text, JSON, or SARIF 2.1.0. The same repository includes a pre-commit hook. It makes no network request during scanning and executes none of the instruction content it reads.

### Downloadable package

The versioned npm-compatible archive can also be [downloaded directly](https://github.com/sunxiayi/repo-agent-instruction-security-scan/releases/download/v1.2.0/repo-agent-instruction-security-scan-1.2.0.tar.gz) or installed globally from its release asset:

```bash
npm install --global https://github.com/sunxiayi/repo-agent-instruction-security-scan/releases/download/v1.2.0/repo-agent-instruction-security-scan-1.2.0.tar.gz
```

Install the validated pre-commit hook from the immutable release tag:

```yaml
repos:
  - repo: https://github.com/sunxiayi/repo-agent-instruction-security-scan
    rev: v1.2.0
    hooks:
      - id: repo-agent-instruction-security-scan
```

SHA-256: `d47c96668525357f60d0b9528118bc668f8eaabf7e2fd0fe87809536115851da`

Verify the signed GitHub build provenance after downloading:

```bash
gh attestation verify repo-agent-instruction-security-scan-1.2.0.tar.gz -R sunxiayi/repo-agent-instruction-security-scan
```

## GitHub Action

The same eight checks are available as the zero-dependency [`sunxiayi/repo-agent-instruction-security-scan`](https://github.com/sunxiayi/repo-agent-instruction-security-scan) GitHub Action. Add it after checkout to review supported instruction files on every pull request:

```yaml
permissions:
  contents: read

steps:
  - uses: actions/checkout@v6
  - uses: sunxiayi/repo-agent-instruction-security-scan@v1
```

The Action runs on Node 24, makes no network calls, requires no token or dependency install, adds line-level annotations and a job summary, and writes machine-readable JSON and SARIF 2.1.0 reports. It fails on high-severity findings by default; `fail-on` can be set to `medium`, `low`, or `none`.

## Interpretation boundary

A finding is a deterministic review prompt, not proof that a repository or maintainer is malicious. Legitimate maintenance guidance can match a pattern. A clean result is not a security guarantee: static patterns cannot establish provenance, inspect every referenced artifact, or validate runtime permission and network controls.

For Agent Skills, the scanner reviews `SKILL.md` instructions only. It does not execute or inspect bundled scripts, binaries, or referenced assets.

Primary references:

- Claude Code secure deployment: https://code.claude.com/docs/en/agent-sdk/secure-deployment
- VS Code custom instruction discovery: https://code.visualstudio.com/docs/agent-customization/custom-instructions
- Snyk Agent Scan source and risk categories: https://github.com/snyk/agent-scan
- AgentSecBench: https://arxiv.org/abs/2605.26269